Supreme Court Asks Centre To Examine Cyber Security Consultant’s Plea For Protection, Recovery & Destruction Of Stolen Personal Data Of Indian Citizens

The Supreme Court has directed the Ministry of Electronics and Information Technology (MeitY) and relevant cybersecurity agencies to deeply examine a comprehensive mechanism submitted by a technology consultant regarding the protection, recovery, and destruction of stolen personal data of Indian citizens.

Observing that the matter is highly technical in nature with minimal core legal disputes involved, the Court disposed of the writ petition, treating it as a supplementary representation for time-bound consideration by specialized ministry experts who can evaluate the petitioner's research on cross-border data theft, domestic surveillance pipelines, and institutional safeguards.

The Bench of Chief Justice Surya Kant, Justice Joymalya Bagchi and Justice Vipul M Pancholi observed, "The petitioner accordingly seeks certain directions regarding data recovery through destruction from foreign jurisdictions; extradition and accountability of accused persons; the constitution of an SIT (Special Investigation Team) to monitor the investigation; regulatory enforcement; the operationalization of the data protection regime; structural safeguards to prevent recurrence; and continuing court-monitored compliance, etc...The issues sought to be raised by the petitioner being highly technical in nature, with a very limited legal regime being involved and hardly any significant legal issue present, it seems to us that the appropriate representation for a digital approach should be made to the Ministry of Electronics and Information Technology (MeitY), information security, and cyber agencies. The petition is granted in continuation of the earlier representations, and the petition is disposed of as a supplementary submission to the ministry for their consideration."

The petitioner, a technology consultant holding a certificate in National Cyber Security from Rashtriya Raksha University, approached the court highlighting a critical breach where biometrics, including his iris data and fingerprints, were compromised. He raised concerns regarding five foreign nationals who are the principal architects of this data theft, which has directly fueled heinous crimes like digital arrests and extortion across India.

The petitioner is said to have brought to the notice of the Union of India two representations on how a comprehensive mechanism can be operationalized for the digital protection of data and for the destruction of such data which has already been stolen, so as to prevent its misuse.

Petitioner submitted, "My writ petition is very sensitive, and with the ongoing crime in which you have also taken suo motu, the kingpins and the data that was compromised in 2017—namely biometrics, my iris, and fingerprints. At this stage, I just want to show you the root cause and the six interim questions so that the Court can decide how we can solve this problem forever for the country."

CJI Kant said, "See, as for extradition—young man, you should be aware of this—unless there is a treaty between the countries, there is no possibility of extradition."

Petitioner replied, "Sir, but we have the treaty that we can ask, or if, suppose sir, one question sir, agar hum data nahi laa sakte hai, theek hai, but hum log data ko restructure karke save toh kar sakte hai sir."

CJI Kant remarked, "Aise country jo humare saath friendly nahi hai, unke logon ko laana hai yaha pe, kahaan se leke aaoga?"

Petitioner replied, "Nahi, sir, aapki baat ekdum sahi hai ki wo ek different diplomatic ban jati hai sir, main samjhta hu. But it's three pipelines, sir; they are within India's control. Adtech—you too will be shocked—SilverPush and InMobi, both of these. One monitors your surveillance precisely, and the other, even if your mobile is switched off, listens to your every sound. Sir, there is a minor symptom: digital arrest. Sir, is there even a single investigation or charge sheet where the victim's mobile and smart devices have been thoroughly checked?"

The Court said, "What India can do about it on its own... it is a commendable thing if you have done some work on this and informed the authority. We can give directions to the authority to deeply examine your suggestions."

Despite the diplomatic roadblocks in retrieving data from foreign servers, the petitioner emphasized that three critical data pipelines—specifically naming Adtech, SilverPush, and InMobi—are operating directly within Indian jurisdiction.

He asserted that these platforms carry out precise surveillance, even intercepting audio while mobile devices are switched off. He pointed out a glaring systemic gap in current investigations, noting that regular charge sheets fail to thoroughly examine the smart devices and mobiles of the victims, leaving the root cause of these digital crimes unaddressed.

In his plea, the petitioner sought strict implementation of the Digital Personal Data Protection Act, 2023, alongside the formation of a Special Investigation Team (SIT) to ensure court-monitored compliance.

The proposed framework aims at establishing structural safeguards to prevent the recurrence of such data breaches, ensuring regulatory enforcement, and setting up an active protocol to destroy stolen Indian data stored on foreign servers to mitigate ongoing misuse.

Acknowledging the petitioner’s extensive research since 2018, the Court observed that the matter is highly technical in nature and contains minimal core legal disputes. The bench stated that specialized ministries and their in-house technical experts are the appropriate authorities to evaluate these solutions.

Consequently, the Supreme Court disposed of the petition, treating it as a supplementary representation forwarded directly to MeitY and relevant cyber security agencies for deep, time-bound consideration.

Cause Title: Nitish Kumar v. Union of India [W.P.(Crl.) No. 163/2026]